Riskcovery

CVE-2023-6377

Xorg-x11-server: out-of-bounds memory reads/writes in xkb button actions

State
Published
Severity
7.8 High
Published
Dec 13, 2023
Updated
Jun 23, 2026
Reserved
Nov 29, 2023

Read the record on cve.org

Description

A flaw was found in xorg-server. Querying or changing XKB button actions such as moving from a touchpad to a mouse can result in out-of-bounds memory reads and writes. This may allow local privilege escalation or possible remote code execution in cases where X11 forwarding is involved.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hredhat

Weaknesses

Affected Products

ProductVersions
Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSIONRed Hat
  • 0:1.1.0-25.el6_10.14 and laterNot affected
Red Hat Enterprise Linux 7Red Hat
  • 0:1.8.0-28.el7_9 and laterNot affected
Red Hat Enterprise Linux 7Red Hat
  • 0:1.20.4-25.el7_9 and laterNot affected
Red Hat Enterprise Linux 8Red Hat
  • 0:1.13.1-2.el8_9.4 and laterNot affected
Red Hat Enterprise Linux 8Red Hat
  • 0:1.20.11-22.el8 and laterNot affected
Red Hat Enterprise Linux 8Red Hat
  • 0:21.1.3-15.el8 and laterNot affected
Red Hat Enterprise Linux 8.2 Advanced Update SupportRed Hat
  • 0:1.9.0-15.el8_2.6 and laterNot affected
Red Hat Enterprise Linux 8.2 Telecommunications Update ServiceRed Hat
  • 0:1.9.0-15.el8_2.6 and laterNot affected
Red Hat Enterprise Linux 8.2 Update Services for SAP SolutionsRed Hat
  • 0:1.9.0-15.el8_2.6 and laterNot affected
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportRed Hat
  • 0:1.11.0-8.el8_4.5 and laterNot affected
Red Hat Enterprise Linux 8.4 Telecommunications Update ServiceRed Hat
  • 0:1.11.0-8.el8_4.5 and laterNot affected
Red Hat Enterprise Linux 8.4 Update Services for SAP SolutionsRed Hat
  • 0:1.11.0-8.el8_4.5 and laterNot affected
Red Hat Enterprise Linux 8.6 Extended Update SupportRed Hat
  • 0:1.12.0-6.el8_6.6 and laterNot affected
Red Hat Enterprise Linux 8.8 Extended Update SupportRed Hat
  • 0:1.12.0-15.el8_8.4 and laterNot affected
Red Hat Enterprise Linux 9Red Hat
  • 0:1.13.1-3.el9_3.3 and laterNot affected
Red Hat Enterprise Linux 9Red Hat
  • 0:1.20.11-24.el9 and laterNot affected
Red Hat Enterprise Linux 9Red Hat
  • 0:22.1.9-5.el9 and laterNot affected
Red Hat Enterprise Linux 9.0 Extended Update SupportRed Hat
  • 0:1.11.0-22.el9_0.5 and laterNot affected
Red Hat Enterprise Linux 9.2 Extended Update SupportRed Hat
  • 0:1.12.0-14.el9_2.2 and laterNot affected
Red Hat Enterprise Linux 6Red Hat

    References

    Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.